Recommended Posts

We have eliminated the barriers to development on all AVIC units including Android Auto. You can now create your own ROM on an SDCard and boot directly into it. We've broken all the security and obfuscations, and we've delivered it to you in a nice, easy-to-use web user interface. This has essentially turned the Pioneer line of units into Nexus devices, that boot off SD Cards.

We now have the ability to change the NEX BSP Settings which allow us to unlock the SD Card and change the boot settings that are in the Pioneer NEX. We are asking all ROM developers with a NEX step and help us create our own ROM to run on all versions on the NEX System.

With the help of all you we can begin to add USB Wifi Drivers, a custom app launcher, the play store, interface skins, more radio presets, radio station data augmented by the internet, Android Auto, iDatalink Gauges, and much more only limited by what we can develop.

NEVER ENTER COPY DEVICE MODE, YOU WILL BRICK YOUR DEVICE!

It is fixable though but a pain as described by WhatIsWhat

OverviewHere's a quick overview of what we will do in this post.

Overview Steps:1. Backup your current BSP and Nor Flash2. Backup your current internal SD Card, or obtain a backup SD Card Image.3. Navigate to https://jenkins.adamoutler.com/job/Customize%20BSP/build?delay=0sec and select the options you want4. Remember your build number and download your package.5. Extract to USB stick6. Put it into USB Port 17. Run Script.8. If you removed the SD Card password you need to insert a new internal SD Card with a backup image.9. Done!

How ToLet's talk about the details, now.

Run Copy Script Mode:

1. Insert the USB Stick to USB Port 1 on the device.2. Start the deck, it will then reboot into Technical TestMode. You must use the keys to navigate the menus. BE VERY CAREFUL AS SOME OPTIONS CAN BRICK YOUR UNIT.

3. Use the Vol - button to navigate to "Write Programs Forcibly"

4. Press the Home Button to select this menu

5. Use the Vol - button to navigate to "Copy Script"

6. Press the Home Button to select this menu7. Take note of the Values on the right hand side of the screen, THESE WILL BE ERASED. (It is currently unknown if these will be needed in the future). If you really want to keep these values though, you can write them down and place them in the corresponding SDCardCWWVersion.txt before you continue.

8. Press the Home Button to run the script.9. After it says 100% press the Home Button to reset the unit and remove the USB stick.

A. dd the AVIC.img you backed up to an SD Card of the appropriate size.B. Insert the new SD Card into the Internal SD Card slot.C. Start up the unit. NOTE: It will take a bit for the device to boot since you have disabled WARP above.

5. Congrats!!!! You can now remove the internal SD Card at will and modify the items in the partition and put it back into the Deck. Good luck on your Custom Rom Development and be sure to share your creations!!

What we are now asking of the ROM Community:

1. Help us by developing custom roms using the steps above and sharing your creations.2. Once we have a custom rom we want to share easily, we will get to the steps where we start Creating a new WARP snapshot, and recompiling them back into PRG Update Files.3. Find a way to enable ADB, One option would be to add a Network Bluetooth Profile, Another option is figuring out USB OTG properly.4. Lets create an app launcher.5. Figure out how to modify the maps.6. Figure out Android Auto/Bluetooth Audio on older models with the new software.

but before you can write you must erase NOR flash region using ioctl command:

/system/bin/ioctl -l 8 -a 4 /dev/mtd/mtd0 1074285826 2424832 65536

Where 2424832 is start address, 65536 is memory erase block size. Looks like both this values must be multiple of 0x10000 (Address is aligned to 0x10000 boundary, size is multiple of 0x10000), at least original firmware uses this alignment.=============U-Boot init

At startup U-Boot checks availability (valid signature and valid crc32 checksum) of both sides of BSP.If Side A is invalid, U-Boot copies Side B to Side A. If Side B is invalid, U-Boot copes Side A to Side B.If both sides is invalid, U-Boot creates default BSP (W/O password) and writes this BSP to both sides.

After this main function tries to initialize sd card and set password. If initialization of sd card (or password) is failed, U-Boot enters EasyRecovery stage.During SD card initialization U-Boot tries to unlock SD card with password stored in BSP. If SD card isn't password locked, U-Boot sets (locks) SD card with password from BSP.If password contains 16 '*' chars or 16 0xFF chars then U-Boot does not use password at all and does not tries to set password on unlocked sd card.So to use SDCard w/o password you need to remove password from BSP (fill with *) and after this insert new unlocked SD card into device.=============U-Boot start

All this values (except CWW Info) is freely available for edit in testmode menu Write Product Information (manual). Changing device serial number isn't affected iGo (iGo still working as expected after serial number change)=============iGo device IDs

744A45534443202010300012DC00DC00 is sd card id (format isn't yet known but I belive it based only on sd card info).This id contains following groups of digits (I hope someone can help us decipher java (smali) code of sdcard id data acquisition):

First group is "tJESDC " in text and unchanged, second group is unknown, third group looks like sd serial and unique for different (not cloned) devices, last two groups is unknownThird part of iGo device id contains first two chars of second group and third part of second group, so for ID744A45534443202010300012DC00DC00 third part will be 74300012DC

Also, iGo works great on cloned devices, so licensing information (data for device identification) and so on is exists only on sd card.

Share this post

Link to post

Share on other sites

1. WARP can be disabled2. Internal SD Password Lock can be removed (Requires a new sd card afterward)3. Debug can be enabled.4. We can modify the Internal SD Card by inserting it into the computer with the above turned on.5. Custom ROM development can truly begin.

What the heck is warp?

A: It's the hibernate function. Ã‚ At the factory, they hibernate the device and every time it turns on it uses this information. This prevents us from loading custom firmware because the deck chooses this memory loaded information over the filesystem changes that we create.

What is the BSP?

A: The BSP is a special are in the NOR Memory (different from the SD Card), where U-Boot, EasyRecovery and all the low-level U-Boot settings are located. It is 84 bytes in size and has two copies in case one fails.

What is NOR Memory?

A: The NOR Memory is an area separate of the SD Card that contains, boot settings, recovery partitions and the boot loader.

Why do we need to remove the SD Card Password?

A: The Pioneer dev's decided to put a hardcoded password lock onto the Internal System SD Card that prevents you from just putting it into your computer. By removing it we allow the ability to remove the internal SD and to put it into any computer to modify the Platform files, without having to run an Update.

What is the SD Card password?

A: LKPFeD4BcVzESR2Y

Can't we just unlock the password on a computer and not change the BSP?

A: Yes, and no. In order to unlock the SD card you need to have the ability to run CMD42 on the SDCard which most linux distributions and osÃ¢â‚¬â„¢s do not have.

What is Debug mode?

A: The Debug mode outputs more logs and turns on a console port somewhere on the device. We still do not know where that is. NOTE: It is most likely possible to patch the kernel to use the iDataLink port as a UART console for ADB.

What are the device paths if I want to change the backup or restore locations?

A:

/mnt/udisk/ for USB1
/mnt/udisk1/ for USB2
/sdcard/ for external sdcard

Share this post

Link to post

Share on other sites

Just to confirm the very first sentence "We have eliminated the barriers to development on all AVIC units including Android Auto." Does this mean what I think (and hope) it does? That it will work on non-NEX units as well (like my X940BT)?

Share this post

Link to post

Share on other sites

Just to confirm the very first sentence "We have eliminated the barriers to development on all AVIC units including Android Auto." Does this mean what I think (and hope) it does? That it will work on non-NEX units as well (like my X940BT)?